Fix permissions for dconf db on Ubuntu #12056

mpurg · 2024-06-11T19:47:05Z

Description:

define permissions for dconf DB files explicitly
also refactor permission setting logic in bash_enable_dconf_user_profile for consistency

Rationale:

root user's umask is used when creating and/or updating dconf DB files, which is typically too restrictive, resulting in files which are not readable by regular users.
fix for https://workbench.cisecurity.org/benchmarks/17074/tickets/21941

openshift-ci · 2024-06-11T19:47:17Z

Hi @mpurg. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

github-actions · 2024-06-11T19:49:01Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-06-11T19:51:32Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_restart_shutdown
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/login-screen\\]|a\\disable-restart-buttons=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/login-screen/disable-restart-buttons$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/login-screen/disable-restart-buttons" >> "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_list
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/login-screen\\]|a\\disable-user-list=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/login-screen/disable-user-list$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/login-screen/disable-user-list" >> "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_enable_smartcard_auth
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/login-screen\\]|a\\enable-smartcard-authentication=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/login-screen/enable-smartcard-authentication$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/login-screen/enable-smartcard-authentication" >> "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_lock_screen_on_smartcard_removal
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/settings-daemon/peripherals/smartcard\\]|a\\removal-action=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/settings-daemon/peripherals/smartcard/removal-action$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/settings-daemon/peripherals/smartcard/removal-action" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_retries
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/login-screen\\]|a\\allowed-failures=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/login-screen/allowed-failures$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/login-screen/allowed-failures" >> "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\automount=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/automount$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/media-handling/automount" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_automount_open
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\automount-open=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/automount-open$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/media-handling/automount-open" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_autorun
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/media-handling\\]|a\\autorun-never=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/media-handling/autorun-never$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/media-handling/autorun-never" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_thumbnailers
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/thumbnailers\\]|a\\disable-all=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/thumbnailers/disable-all$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/thumbnailers/disable-all" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_create
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/nm-applet\\]|a\\disable-wifi-create=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/nm-applet/disable-wifi-create$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/nm-applet/disable-wifi-create" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_wifi_notification
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/nm-applet\\]|a\\suppress-wireless-networks-available=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/nm-applet/suppress-wireless-networks-available$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/nm-applet/suppress-wireless-networks-available" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_credential_prompt
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/Vino\\]|a\\authentication-methods=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/Vino/authentication-methods$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/Vino/authentication-methods" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_remote_access_encryption
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/Vino\\]|a\\require-encryption=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/Vino/require-encryption$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/Vino/require-encryption" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_enabled
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\idle-activation-enabled=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/idle-activation-enabled$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/screensaver/idle-activation-enabled" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_activation_locked
@@ -18,7 +18,6 @@
 then
     echo "/org/gnome/desktop/screensaver/idle-activation-enabled" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay
@@ -37,7 +37,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/session\\]|a\\idle-delay=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay
@@ -37,7 +37,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-delay=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_enabled
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\lock-enabled=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/lock-enabled$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/screensaver/lock-enabled" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_locked
@@ -18,7 +18,6 @@
 then
     echo "/org/gnome/desktop/screensaver/lock-enabled" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_mode_blank
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\picture-uri=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/picture-uri$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/screensaver/picture-uri" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_info
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/screensaver\\]|a\\show-full-name-in-top-bar=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/screensaver/show-full-name-in-top-bar$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/screensaver/show-full-name-in-top-bar" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks
@@ -18,7 +18,6 @@
 then
     echo "/org/gnome/desktop/screensaver/lock-delay" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks
@@ -18,7 +18,6 @@
 then
     echo "/org/gnome/desktop/session/idle-delay" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_ctrlaltdel_reboot
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/settings-daemon/plugins/media-keys\\]|a\\logout=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/settings-daemon/plugins/media-keys/logout$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/settings-daemon/plugins/media-keys/logout" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_geolocation
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/system/location\\]|a\\enabled=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 # If files contain ibus or distro, ignore them.
@@ -69,7 +68,6 @@
     else
         sed -i "\\|\\[org/gnome/clocks\\]|a\\geolocation=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/system/location/enabled$" "/etc/dconf/db/" \
@@ -88,7 +86,6 @@
 then
     echo "/org/gnome/system/location/enabled" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/clocks/geolocation$" "/etc/dconf/db/" \
@@ -107,7 +104,6 @@
 then
     echo "/org/gnome/clocks/geolocation" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_disable_user_admin
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/desktop/lockdown\\]|a\\user-administration-disabled=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/desktop/lockdown/user-administration-disabled$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/desktop/lockdown/user-administration-disabled" >> "/etc/dconf/db/local.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_banner_enabled
@@ -34,7 +34,6 @@
     else
         sed -i "\\|\\[org/gnome/login-screen\\]|a\\banner-message-enable=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/login-screen/banner-message-enable$" "/etc/dconf/db/" \
@@ -53,7 +52,6 @@
 then
     echo "/org/gnome/login-screen/banner-message-enable" >> "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text' differs.
--- xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
+++ xccdf_org.ssgproject.content_rule_dconf_gnome_login_banner_text
@@ -53,7 +53,6 @@
     else
         sed -i "\\|\\[org/gnome/login-screen\\]|a\\banner-message-text=${escaped_value}" "${DCONFFILE}"
 fi
-
 dconf update
 # Check for setting in any of the DConf db directories
 LOCKFILES=$(grep -r "^/org/gnome/login-screen/banner-message-text$" "/etc/dconf/db/" \
@@ -72,7 +71,6 @@
 then
     echo "/org/gnome/login-screen/banner-message-text" >> "/etc/dconf/db/gdm.d/locks/00-security-settings-lock"
 fi
-
 dconf update
 
 else

github-actions · 2024-06-11T19:52:38Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12056
This image was built from commit: 213bbad

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12056

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12056 make deploy-local

dodys

lgtm, thanks!

dodys · 2024-06-12T16:05:50Z

/packit build

mpurg · 2024-06-12T17:00:29Z

@marcusburghardt @Mab879 , the testing-farm:centos-7-x86_64:/static-checks tests have been failing continuously again. Is there something that can be done about this?

root user's umask is used when creating and/or updating dconf DB files, which is typically too restrictive, resulting in files which are not readable by regular users. Solution is to explicitly define the permissions.

codeclimate · 2024-06-12T19:26:44Z

Code Climate has analyzed commit 213bbad and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

Mab879 · 2024-06-12T21:32:32Z

@marcusburghardt @Mab879 , the testing-farm:centos-7-x86_64:/static-checks tests have been failing continuously again. Is there something that can be done about this?

There seems be some sort of interment error, especially with RHEL 7. A rerun or two seems to fix it. If we can get more information on it might be easier to fix. However seeing that #9987 was filled in 2022 this seems to be a long standing issue.

mpurg · 2024-06-13T05:53:04Z

@marcusburghardt @Mab879 , the testing-farm:centos-7-x86_64:/static-checks tests have been failing continuously again. Is there something that can be done about this?

There seems be some sort of interment error, especially with RHEL 7. A rerun or two seems to fix it. If we can get more information on it might be easier to fix. However seeing that #9987 was filled in 2022 this seems to be a long standing issue.

It's actually two tests that were failing throughout the several force pushes and @dodys manually restarting the tests:

Gate / Build, Test on CentOS 7 (Container) (pull_request) : this gets solved randomly after a rerun or two as you say. I suspect it could be related to Build on CentOS 7 sometimes fails #9987
testing-farm:centos-7-x86_64:/static-checks: this one failed to pass even once during the 5 complete reruns and several attempts at rerunning only the specific test by @dodys

Mab879 · 2024-06-13T12:12:00Z

@marcusburghardt @Mab879 , the testing-farm:centos-7-x86_64:/static-checks tests have been failing continuously again. Is there something that can be done about this?

There seems be some sort of interment error, especially with RHEL 7. A rerun or two seems to fix it. If we can get more information on it might be easier to fix. However seeing that #9987 was filled in 2022 this seems to be a long standing issue.

It's actually two tests that were failing throughout the several force pushes and @dodys manually restarting the tests:
* `Gate / Build, Test on CentOS 7 (Container) (pull_request) `: this gets solved randomly after a rerun or two as you say. I suspect it could be related to [Build on CentOS 7 sometimes fails #9987](https://github.com/ComplianceAsCode/content/issues/9987)

* `testing-farm:centos-7-x86_64:/static-checks`: this one failed to pass even once during the 5 complete reruns and several attempts at rerunning only the specific test by @dodys

There is something up with RHEL 7 Testing Farm tests. I'm doing some investigation now.

Mab879 · 2024-06-13T12:47:33Z

@marcusburghardt @Mab879 , the testing-farm:centos-7-x86_64:/static-checks tests have been failing continuously again. Is there something that can be done about this?

There seems be some sort of interment error, especially with RHEL 7. A rerun or two seems to fix it. If we can get more information on it might be easier to fix. However seeing that #9987 was filled in 2022 this seems to be a long standing issue.

It's actually two tests that were failing throughout the several force pushes and @dodys manually restarting the tests:
* `Gate / Build, Test on CentOS 7 (Container) (pull_request) `: this gets solved randomly after a rerun or two as you say. I suspect it could be related to [Build on CentOS 7 sometimes fails #9987](https://github.com/ComplianceAsCode/content/issues/9987)

* `testing-farm:centos-7-x86_64:/static-checks`: this one failed to pass even once during the 5 complete reruns and several attempts at rerunning only the specific test by @dodys
There is something up with RHEL 7 Testing Farm tests. I'm doing some investigation now.

So the requirement for RHEL 7 Testing Farm has been dropped.

Thanks for your patience.

dodys

lgtm, thanks!

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Jun 11, 2024

dodys approved these changes Jun 12, 2024

View reviewed changes

mpurg force-pushed the fix_dconf_perms_2 branch 4 times, most recently from 5368dc0 to e86b99d Compare June 12, 2024 13:51

mpurg force-pushed the fix_dconf_perms_2 branch from e86b99d to cbc0a4b Compare June 12, 2024 17:05

Fix permissions for dconf db on Ubuntu

213bbad

root user's umask is used when creating and/or updating dconf DB files, which is typically too restrictive, resulting in files which are not readable by regular users. Solution is to explicitly define the permissions.

mpurg force-pushed the fix_dconf_perms_2 branch from cbc0a4b to 213bbad Compare June 12, 2024 18:43

marcusburghardt added Ubuntu Ubuntu product related. Bash Bash remediation update. labels Jun 13, 2024

marcusburghardt added this to the 0.1.74 milestone Jun 13, 2024

dodys approved these changes Jun 13, 2024

View reviewed changes

dodys merged commit 9be0ad0 into ComplianceAsCode:master Jun 13, 2024
104 of 108 checks passed

marcusburghardt assigned dodys Jun 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix permissions for dconf db on Ubuntu #12056

Fix permissions for dconf db on Ubuntu #12056

mpurg commented Jun 11, 2024 •

edited

Loading

openshift-ci bot commented Jun 11, 2024

github-actions bot commented Jun 11, 2024

github-actions bot commented Jun 11, 2024

github-actions bot commented Jun 11, 2024 •

edited

Loading

dodys left a comment

dodys commented Jun 12, 2024

mpurg commented Jun 12, 2024 •

edited

Loading

codeclimate bot commented Jun 12, 2024

Mab879 commented Jun 12, 2024

mpurg commented Jun 13, 2024

Mab879 commented Jun 13, 2024

Mab879 commented Jun 13, 2024

dodys left a comment

Fix permissions for dconf db on Ubuntu #12056

Fix permissions for dconf db on Ubuntu #12056

Conversation

mpurg commented Jun 11, 2024 • edited Loading

Description:

Rationale:

openshift-ci bot commented Jun 11, 2024

github-actions bot commented Jun 11, 2024

github-actions bot commented Jun 11, 2024

github-actions bot commented Jun 11, 2024 • edited Loading

dodys left a comment

Choose a reason for hiding this comment

dodys commented Jun 12, 2024

mpurg commented Jun 12, 2024 • edited Loading

codeclimate bot commented Jun 12, 2024

Mab879 commented Jun 12, 2024

mpurg commented Jun 13, 2024

Mab879 commented Jun 13, 2024

Mab879 commented Jun 13, 2024

dodys left a comment

Choose a reason for hiding this comment

mpurg commented Jun 11, 2024 •

edited

Loading

github-actions bot commented Jun 11, 2024 •

edited

Loading

mpurg commented Jun 12, 2024 •

edited

Loading